virt/kvm/assigned-dev.c: Set 'dev->irq_source_id' to '-1' after free it

As a generic function, deassign_guest_irq() assumes it can be called even if assign_guest_irq() is not be called successfully (which can be triggered by ioctl from user mode, indirectly). So for assign_guest_irq() failure process, need set 'dev->irq_source_id' to -1 after free 'dev->irq_source_id', or deassign_guest_irq() may free it again. Signed-off-by: Chen Gang <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]>
niw · Aug 19, 2014 · 30d1e0e · 30d1e0e
1 parent 0d234da
commit 30d1e0e
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c
@@ -526,8 +526,10 @@ static int assign_guest_irq(struct kvm *kvm,
 		dev->irq_requested_type |= guest_irq_type;
 		if (dev->ack_notifier.gsi != -1)
 			kvm_register_irq_ack_notifier(kvm, &dev->ack_notifier);
-	} else
+	} else {
 		kvm_free_irq_source_id(kvm, dev->irq_source_id);
+		dev->irq_source_id = -1;
+	}
 
 	return r;
 }